playwright-master

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt's examples hardcode plaintext credentials (e.g., 'user@test.com', 'password123') and instruct filling login fields with them, which requires the LLM to emit secret values verbatim in generated test code.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The skill’s required workflow (Playwright browser automation) can fetch and read arbitrary page body text at runtime via page.goto(...) / DOM extraction (e.g., page.$$eval(...)), which may include outsider-authored free text from public web content or other users’ pages.